Article 4

Meanwhile, I'm working on updates to https://devbox.computer and one thing I had on my list was to run containers not as root. This is harder than I thought, since it seems bind mounts have to show up as root (or a matching uid from the host).